ClawHub
Back to skill

Security audit

FX Monitor

Security checks for vulnerabilities and agentic risk

Overview

This FX monitor mostly matches its stated purpose, but needs Review because it can run a user-specific external script path and may disable unrelated cron jobs.

Review carefully before installing. Use only if you are comfortable with a skill that runs a Python checker, fetches the Bank of China FX page, and writes a local CSV history. Do not let it manage cron unless you first confirm it will preserve all existing scheduled jobs, and change the workflow to execute the bundled script by relative/trusted path rather than /home/xhp/....

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T07 · Tool Hijacking and Spoofing

Error
Location
SKILL.md:10
Finding

Execution of an Unbundled Script Through a Fixed External Path

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:39
Finding

Instruction to Disable Unrelated Scheduled Tasks

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_boc_fx.py:123
Finding

Unrestricted User-Controlled URL Fetching Enables SSRF

Content
View full analysis
str: req = Request( url, headers={ "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0 Safari/537.36", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8", }, ) with urlopen(req, timeout=20) as resp: charset = resp.headers.get_content_charset() or "utf-8" return resp.read().decode(charset, errors="replace") ``` The command-line argument is passed directly to that function: ```python parser = argparse.ArgumentParser(description="Check Bank of China FX changes and emit key=value output.") parser.add_argument("--history", default=str(DEFAULT_HISTORY), help="CSV path for historical snapshots") parser.add_argument("--url", default=BOC_URL, help="Bank of China FX page URL") args = parser.parse_args() history_path = Path(args.history).expanduser() try: html = fetch_html(args.url) ``` ### Technical Analysis The `--url` argument allows the caller to replace the intended Bank of China endpoint with an arbitrary destination. The code performs no validation of the URL scheme, hostname, port, redirect destination, or resolved IP address. A caller can therefore cause the agent host to issue HTTP requests to loopback addresses, private network ranges, link-local services, or cloud metadata endpoints. Redirects may also move an initially acceptable request to a prohibited destination because redirect targets are not independently validated. The parser expects a particular HTML table, which limits direct extraction of arbitrary response bodies. However, this does not eliminate S ...[truncated 1547 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
- `NO_ALERT`: return `NO_REPLY` unless the user explicitly asked for a status report.
   - `ERROR`: report a short Chinese failure message with `MESSAGE`.

## Output rules

For alert messages:
- Start with `【汇率告警】`.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to run a local Python script that performs network access and writes history to disk, but the manifest declares no explicit tool scope or permissions. This creates an authorization and review gap: consumers cannot easily tell that using the skill implies code execution, outbound network access, and local file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description is broad enough to overlap with generic requests about alerts, exchange rates, or cron troubleshooting, which can cause the skill to activate outside its narrow intended context. Over-broad routing increases the chance that an agent invokes code, network access, or cron-related instructions when a simpler or safer response would have sufficed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.